full-disclosure - Clarification on Xitami DoS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <001101c23c05$b0510d00$e62d1c41@kc.rr.com>
From: mattmurphy at kc.rr.com (Matthew Murphy)
Subject: Clarification on Xitami DoS

Due to conflicting results in some tests, I believe that my
previous post regarding this issue contained some inaccurate
statements:

The root cause of this vulnerability is not a sudden flood of
connections; the issue appears to be that Xitami 2.5 Beta does
not "clean up" the resources of a connection that has been
broken/closed in some cases.  As a result, the vulnerability can
be triggered simply by heavy traffic.

Unsetting a limit you may have on HTTP connections will not
avoid this vulnerability, and could worsen the affects of any
actual overload.  However, systems with limits set will exceed 
those limits more quickly.

The vulnerability appears to be present in the way Xitami
handles Keep-Alive connections.  Specifically, the server will
not close Keep-Alive connections even when appropriate
timeouts have been set.

"The reason the mainstream is thought
of as a stream is because it is
so shallow."
                     - Author Unknown